CVE-2025-49289 WordPress PDF for WPForms <= 5.5.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for WPForms: from n/a through 5.5.0...

CVE-2025-49291 WordPress Calculated Fields Form <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in codepeople Calculated Fields Form allows Cross Site Request Forgery. This issue affects Calculated Fields Form: from n/a through 5.3.58...

CVE-2025-49288 WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability

Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through = 1.3.5...

CVE-2025-49268

CVE-2025-49268 is a missing-authorization (broken access control) vulnerability in Verge3D by Soft8Soft. Affected software: Verge3D Publishing and E‑Commerce, versions up to and including 4.9.4 (historical range listed as from n/a through 4.9.4). Public references indicate unauthorized access con...

CVE-2025-49262 WordPress Sina Extension for Elementor <= 3.6.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shaonsina Sina Extension for Elementor allows Stored XSS. This issue affects Sina Extension for Elementor: from n/a through 3.6.1...

CVE-2025-49250 WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Team Showcase: from n/a through 25.05.13...

CVE-2025-49238

CVE-2025-49238 is a CSRF vulnerability in the Everest Backup WordPress plugin by Everest Themes affecting versions up to 2.3.3. The Wordfence vulnerability entry notes this was a Cross-Site Request Forgery issue with a CVSS v3.1 base score of 4.3 (Medium) and indicates patching has been applied i...

CVE-2025-49236

CVE-2025-49236 is a real Missing Authorization vulnerability affecting Raychat up to version 2.1.0, where functionality is accessible without proper ACL constraints. The CVE is documented with a CVSS v3.1 base score of 5.3 (Network attack, Low attack complexity, No privileges, No user interaction...

CVE-2025-5760

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-48337

Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3...

CVE-2025-41361

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit th...

CVE-2025-41361 Uncontrolled resource consumption vulnerability in IDF and ZLF

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit th...

CVE-2025-48329 WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Real Time Validation for Gravity Forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through 1.7.0...

CVE-2025-47586

CVE-2025-47586 is an unauthenticated Local File Inclusion in the WordPress plugin Motors - Events (versions up to and including 1.4.7). Exploitation arises from improper filename handling in PHP Include/Require, enabling an attacker to trick the application into including local files. Public sour...

CVE-2025-5239 Domain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter

The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘classname’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-48781

creationtimestamp| type| source ---|---|--- 2025-06-06 11:02:40+00:00| seen| Telegram/IzUnLEyll0bCDFLZZ6Gvcvh0qc-X8AIjXpNZJHup4VBEb48 2025-06-06 11:12:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqwpbxdvre2q...

CVE-2025-5758

CVE-2025-5758 affects SourceCodester Open Source Clinic Management System v1.0. The vulnerability is a SQL injection in the /doctor.php file triggered by manipulating the doctorname parameter, with remote access possible and multiple parameters potentially affected. Exploitation details are publi...

CVE-2025-48781

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...

CVE-2025-48780

creationtimestamp| type| source ---|---|--- 2025-06-06 09:31:41+00:00| published-proof-of-concept| Telegram/mYiFhS0KI41FnuJb80DPaIeUDJlgHATfKqT73V-Gr4Yn1fQ 2025-06-06 11:02:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqwoq2edic2q...

CVE-2025-48782 Soar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious file...